Fortisoar Paas EUVD-2026-22329

Requires FortiSOAR (PaaS or on-premise) versions 7.5.0–7.5.2 or 7.6.0–7.6.3 with 2FA enabled. Attacker must intercept and decrypt captured 2FA authentication traffic, then replay the request before token expiration with precise timing. Victim interaction: user must initiate authentication attempt.

Real-world exploitation risk is moderate despite the 7.5 CVSS score, constrained by high attack complexity (AC:H) requirements. Attackers must achieve three sequential conditions: network positioning to intercept authentication traffic, capability to decrypt TLS-protected communications (requiring certificate compromise, cryptographic weaknesses, or active MITM), and precise timing to replay tokens before expiration. The PR:N (no privileges required) and AV:N (network attack vector) indicate external threat actors can attempt exploitation, but UI:R (user interaction required) means attacks must coincide with legitimate user authentication attempts. No CISA KEV listing suggests this is not confirmed as actively exploited in the wild. No public exploit code identified at time of analysis, reducing immediate weaponization risk. The SSVC framework would likely classify this as 'Attend' rather than 'Act' priority: exploitation status is PoC (not active), automatable is 'No' due to complex preconditions, and technical impact is 'Total' (authentication bypass grants full access). Organizations using FortiSOAR should prioritize patching based on their threat model-those in high-risk sectors or with exposed authentication endpoints face elevated risk compared to air-gapped or heavily network-segmented deployments.

An attacker positions themselves as a man-in-the-middle on the network path between a FortiSOAR user and the authentication server, potentially through ARP spoofing, rogue Wi-Fi access points, or compromised network infrastructure. When a legitimate administrator authenticates to FortiSOAR using 2FA, the attacker captures the encrypted authentication traffic and decrypts it using previously compromised TLS certificates or cryptographic vulnerabilities. Within the 2FA token's validity window (typically seconds to minutes), the attacker replays the captured authentication request to the FortiSOAR server, successfully bypassing both password and two-factor authentication to gain full administrative access to the SOAR platform. No public exploit code identified at time of analysis, though the attack methodology follows established replay attack patterns.